Splunk Search

How to search multiple virtual indexes with Splunk Analytics for Hadoop?

EricLloyd79
Builder

Hello, we currently have two virtual indexes with data in them retrieving data from Hadoop Distributed File System.
We want to run one query to search over both indexes.
I hoped that:
index=abc OR index=xyz "keyword"
would work correctly but it only returns values from index=abc.
Anyone got any idea on how to search multiple indexes?

0 Karma

rdagan_splunk
Splunk Employee
Splunk Employee

I just tried it without any issues.
I tried both index=xyz OR index=abc somekeyword as well as (index=abc somekey=somevalue) OR (index="xyz" somekey=somevalue)

0 Karma

EricLloyd79
Builder

Weird, I wonder why my version isn't working. thanks.

0 Karma

burwell
SplunkTrust
SplunkTrust

Hi Eric. What version of Splunk are you running?

So I saw a similar issue: https://answers.splunk.com/answers/536338/hunk-searching-two-different-virtual-indexes-using.html

I've upgraded all our Splunk instances to Splunk 6.6 and I cannot reproduce this error.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Does the index=xyz "keyword" returns result when run separately?

0 Karma

EricLloyd79
Builder

Yes each one returns individual results.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...